QuanCert: Leakage-safe localized model repair and deployment-risk certification for learning-enabled building climate control

Abstract

Learning-enabled predictive controllers are becoming central to building climate control, but their control-oriented models are rarely wrong everywhere: actuation gains may drift only in localized operating regimes, and a controller that trusts such misspecification pays for it at every deployment step. We introduce QuanCert, a discover-repair-select-veto-certify protocol that turns localized model misspecification into an auditable, repairable, and certifiable object. QuanCert partitions the operating space into cells, discovers misspecified cells with false-discovery-rate control, repairs local actuation gains with James-Stein shrinkage, selects the repair back-end on held-out calibration data, vetoes repairs that would introduce avoidable closed-loop harm, and issues a distribution-free binomial certificate on deployment event risk. The protocol is leakage-safe by construction: discovery, selection, and certification never touch the test split. Across five building-control benchmarks spanning two BOPTEST cases, two EnergyPlus climates, and a controlled stress test, QuanCert reduces derated-cell gain-estimation error by 84.9\% on average relative to the nominal model, wins on every dataset against every internal baseline, and outperforms eight recent robust, conformal, Gaussian-process, Koopman, and safe-learning control families by 51--52\% with paired significance below 0.001. The harm-aware veto removes 74\% of avoidable closed-loop harm while retaining the accuracy advantage; the protocol is insensitive to both key hyperparameters, generalizes across four surrogate backbones, and runs end-to-end in under 0.6 seconds per dataset on a single CPU core. The certificate is classical, finite-sample, and hardware-independent, while the event-table estimator also admits a quantum amplitude-estimation readout for emerging quantum risk-analysis hardware.

Keywords